CVE-2026-33283CWE-476

Ella Core panics on malformed ULNASTransport Message without a Request Type

Medium · published March 23, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
43.3
In the wild
Unconfirmed
What it is

Ella Core is a 5G core designed for private networks. Versions prior to 1.6.0 panic when processing malformed UL NAS Transport NAS messages without a Request Type. An attacker able to send crafted NAS messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. Version 1.6.0 adds a guard when receiving an UL NAS Message without a Request Type given no SM Context.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00519 · 43.3th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2026-03-23T23:49Z
EPSS history
Timeline
  • 23 MAR 23:49Z
    Ella Core panics on malformed ULNASTransport Message without a Request Type
    cvelistv5